Series

PortSwigger SQL injection (SQLi) Labs

Throughout this series, I'll explore the effective utilization of the Burp Suite application from PortSwigger Academy, offering valuable insights into honing reconnaissance and analysis skills.

Articles in this series

Lab: SQL injection vulnerability allowing login bypass

Jan 15, 20242 min read77 views

Lab Scenario: Our objective is to explore and exploit a web application's SQL injection vulnerability, allowing us to bypass the login process. By...

Lab: SQL injection vulnerability allowing login bypass

Lab: SQL injection with filter bypass via XML encoding

Jan 23, 20242 min read59 views

Lab Scenario: Our mission is to explore and exploit a web application's SQL injection vulnerability while overcoming a Web Application Firewall (WAF)...

Lab: SQL injection with filter bypass via XML encoding

Lab: SQL injection attack, querying the database type and version on MySQL and Microsoft

Feb 5, 20242 min read30 views

We will explore the practical application of Burp Suite to identify and exploit SQL injection vulnerabilities, shedding light on potential risks and...

Lab: SQL injection attack, querying the database type and version on MySQL and Microsoft

Lab: SQL injection UNION attack, retrieving multiple values in a single column

Feb 12, 20242 min read16 views

In this educational guide, we will delve into the process of leveraging Burp Suite to intercept and modify requests, focusing on the product category...

Lab: SQL injection UNION attack, retrieving multiple values in a single column

Lab: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data

Feb 26, 20242 min read36 views

Lab Scenario: Our objective is to understand and exploit a SQL injection vulnerability in the WHERE clause of a web application's stock check feature....

Lab: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data

Lab: SQL injection UNION attack, finding a column containing text

Mar 5, 20242 min read21 views

In this lab, our goal is to determine the number of columns returned by the query, offering a valuable insight into potential SQL injection...

Lab: SQL injection UNION attack, finding a column containing text